@orkestrel/scaffold 0.0.75 → 0.0.77

package/dist/host/CLAUDE.md

@@ -24,14 +24,14 @@ follows it. This file adds only what Claude Code does differently, and cannot we
 - Every Workflow `agent()` node names its model alias explicitly. The Workflow custom-agent path
   does not apply a role file's `model:` pin, so a node that omits the alias runs on the session
   model and the lane reads normal on the wrong engine.
-- Run the main session on `opus` at high effort, set by `/model opus` or `"model": "opus"`. Opus 5
+- Run the main session on `opus` at high effort, set by `/model opus` or `"model": "opus"`. Opus 5.5
   is the Orchestrator in this harness. Its Orchestrator duties are unchanged if it is configured
   otherwise.
-- The Orchestrator shares its engine with `planner`, `reviewer`, and `opus`. Run the Sol `analyst`
+- The Orchestrator shares its engine with `planner`, `reviewer`, and `opus`. Run the Astra `analyst`
   in every design round and every audit round so the judgment is not single-engine, and confirm from
-  its journal that it reached Sol. A bridge driver that answers from its own engine
+  its journal that it reached Astra. A bridge driver that answers from its own engine
   collapses the round to one engine and its ruling still reads as normal.
-- Claude role frontmatter accepts Claude models only. Reach Grok through `grok`, and Sol through
+- Claude role frontmatter accepts Claude models only. Reach Grok through `grok`, and Astra through
   `analyst` and `sol`. Never put an external model in `model:`. Treat
   `.agents/transports/codex.md` as the transport contract for those bridges, never as a
   dispatchable role.
@@ -39,11 +39,11 @@ follows it. This file adds only what Claude Code does differently, and cannot we
 
 ## Bench wiring
 
-- `.mcp.json` registers `codex mcp-server` for short interactive exchanges with Sol. Project MCP
+- `.mcp.json` registers `codex mcp-server` for short interactive exchanges with Astra. Project MCP
   servers are enabled without prompting, so the wiring works headless.
 - `.claude/skills/<name>/SKILL.md` is a bridge that loads the canonical skill from
   `.agents/skills/<name>/SKILL.md`. It adds no independent process.
-- Claude Code exposes `claude mcp serve`, which is how a Codex-primary session reaches Opus 5.
+- Claude Code exposes `claude mcp serve`, which is how a Codex-primary session reaches Opus 5.5.
 
 ## Claude Code Cloud
 

package/dist/host/agents/orchestration.md

@@ -29,11 +29,11 @@ One workflow runs across all providers. Each engine has one job and never takes
 | Engine          | Job                                                   | Posture                                      |
 | --------------- | ----------------------------------------------------- | -------------------------------------------- |
 | **Cursor Grok** | Absorption, distillation, scouting, bounded research  | Read-only; returns evidence, never decisions |
-| **Opus 5**      | Subjective design, design-fit review, implementation  | Proposes, audits, implements; never accepts  |
-| **GPT-5.6 Sol** | Objective analysis, correctness audit, implementation | Proposes, audits, implements; never accepts  |
+| **Opus 5.5**    | Subjective design, design-fit review, implementation  | Proposes, audits, implements; never accepts  |
+| **GPT-6 Astra** | Objective analysis, correctness audit, implementation | Proposes, audits, implements; never accepts  |
 
-- Route each nontrivial implementation unit to Opus or Sol. Objective, constraint-heavy,
-  mechanical-precision work goes to Sol. API-shape, naming, and documentation-voice work goes to
+- Route each nontrivial implementation unit to Opus or Astra. Objective, constraint-heavy,
+  mechanical-precision work goes to Astra. API-shape, naming, and documentation-voice work goes to
   Opus. Cursor Composer is not an implementation route, and no `composer` role exists.
 - Design runs the adversarial pass. § Execution loop's audit step fixes which lanes an audit runs.
 
@@ -44,12 +44,12 @@ reasoning effort.
 
 | Harness     | Orchestrator engine |
 | ----------- | ------------------- |
-| Claude Code | Opus 5              |
-| Codex       | GPT-5.6 Sol         |
+| Claude Code | Opus 5.5            |
+| Codex       | GPT-6 Astra         |
 | Cursor      | Cursor Grok         |
 
 - The Orchestrator reconciles. No engine reconciles itself or accepts its own work.
-- The Orchestrator shares its engine with one lane: Opus in Claude Code, Sol in Codex. That lane is
+- The Orchestrator shares its engine with one lane: Opus in Claude Code, Astra in Codex. That lane is
   still dispatched as a separate subagent with a clean context, never run inline.
 - In a fix round the auditor is an engine that did not write it. When the writer's engine is the
   Orchestrator's engine, the auditor is the other lane.
@@ -84,12 +84,12 @@ names nothing else, so never write it of a lane. A verdict file's recorded reaso
 
 ### Engine assignment
 
-By default Opus 5 holds the subjective lane and Sol holds the objective lane.
+By default Opus 5.5 holds the subjective lane and Astra holds the objective lane.
 
 Swap the lanes whenever the round needs an engine that is not the one running that lane. Bench
 darkness is one trigger and the writer's engine is another: § Execution loop's audit step requires
-an auditor that did not write the work, so where Sol wrote the work under audit, give the objective
-lane to Opus 5 and the subjective lane to Sol, and reverse that where Opus 5 wrote it. Both engines
+an auditor that did not write the work, so where Astra wrote the work under audit, give the objective
+lane to Opus 5.5 and the subjective lane to Astra, and reverse that where Opus 5.5 wrote it. Both engines
 still run, so this is a lane swap rather than a substitution. Record which engine held which lane in
 the routing ledger.
 
@@ -97,15 +97,15 @@ When one engine is unavailable, the remaining engine runs **every** lane — sti
 subagents, still clean contexts, still blind to each other, each told which perspective it holds.
 Record the substitution.
 
-| Harness     | Engine unavailable                | Runs every lane |
-| ----------- | --------------------------------- | --------------- |
-| Claude Code | Sol (Codex bench dark)            | Opus 5          |
-| Codex       | Opus 5 (Claude CLI dark)          | GPT-5.6 Sol     |
-| Cursor      | Opus 5 and Sol (MCP servers dark) | Cursor Grok     |
+| Harness     | Engine unavailable                    | Runs every lane |
+| ----------- | ------------------------------------- | --------------- |
+| Claude Code | Astra (Codex bench dark)              | Opus 5.5        |
+| Codex       | Opus 5.5 (Claude CLI dark)            | GPT-6 Astra     |
+| Cursor      | Opus 5.5 and Astra (MCP servers dark) | Cursor Grok     |
 
 - Never assign Grok to either lane in Claude Code or Codex. If the remaining native engine is also
   unavailable there, the pass cannot run: stop and report rather than substituting Grok.
-- Grok takes every lane only in Cursor, and only when Opus 5 and Sol are both unavailable.
+- Grok takes every lane only in Cursor, and only when Opus 5.5 and Astra are both unavailable.
 - Treat a lane that returns no verdicts as a lane that did not run. Re-probe the bench before ruling
   on why, per Bench laws rule "One lane at a time per bench". A bench lane reporting that its driver
   executed and its engine was never reached is a dark bench, not a result. Record the bench dark
@@ -133,7 +133,7 @@ Fall back in this order and record the substitution:
   reading and `researcher` excludes repository-scale absorption, so neither takes that step.
 - Never route absorption to the Orchestrator itself, even when the Orchestrator is Grok. Keep the
   main context at decision level; in Cursor that means a Grok executor session, not this one.
-- Never spend Opus 5 or Sol on it.
+- Never spend Opus 5.5 or Astra on it.
 - Grok is read-only, so a writing unit never routes there. Fully specified mechanical writing goes
   to `builder` or `application` on the harness's cheap native tier.
 - `verifier` runs commands and reports exit codes, so it stays on the native tier too.
@@ -162,11 +162,11 @@ when the role file already pins it.
 | Job                                      | Claude role (`.claude/agents/`) | Codex role (`.codex/agents/`) | Engine                        |
 | ---------------------------------------- | ------------------------------- | ----------------------------- | ----------------------------- |
 | Absorption, distillation, scouting       | `grok`                          | `grok`                        | Cursor Grok (bridge)          |
-| Creative design and alternatives         | `planner`                       | `planner`                     | Opus 5 (native / bridge)      |
-| Design-fit review and audit              | `reviewer`                      | `reviewer`                    | Opus 5 (native / bridge)      |
-| Objective analysis and correctness audit | `analyst`                       | `analyst`                     | GPT-5.6 Sol (bridge / native) |
-| Nontrivial implementation (objective)    | `sol`                           | `sol`                         | GPT-5.6 Sol (bridge / native) |
-| Nontrivial implementation (subjective)   | `opus`                          | `opus`                        | Opus 5 (native / bridge)      |
+| Creative design and alternatives         | `planner`                       | `planner`                     | Opus 5.5 (native / bridge)    |
+| Design-fit review and audit              | `reviewer`                      | `reviewer`                    | Opus 5.5 (native / bridge)    |
+| Objective analysis and correctness audit | `analyst`                       | `analyst`                     | GPT-6 Astra (bridge / native) |
+| Nontrivial implementation (objective)    | `sol`                           | `sol`                         | GPT-6 Astra (bridge / native) |
+| Nontrivial implementation (subjective)   | `opus`                          | `opus`                        | Opus 5.5 (native / bridge)    |
 | Bulk reading and evidence distillation   | `distiller`                     | `distiller`                   | Grok → Luna → Sonnet          |
 | Bounded primary-source research          | `researcher`                    | `researcher`                  | Grok → Luna → Sonnet          |
 | Repository reconnaissance                | `scout`                         | `scout`                       | Grok → Luna → Sonnet          |
@@ -197,18 +197,18 @@ when the role file already pins it.
   job to a bench means shipping that catalog across, which costs more than the bench saves.
 - A transport contract lives in `.agents/transports/`, not in an agents directory. A harness lists
   its dispatchable agents from that directory, so a contract that is never dispatched sits outside
-  it. `.agents/transports/codex.md` is the shared Sol transport contract and
+  it. `.agents/transports/codex.md` is the shared Astra transport contract and
   `.agents/transports/claude.md` the shared Opus transport contract. Neither is a route: `analyst`
-  and `sol` are the named Sol bridges, `planner`, `reviewer`, and `opus` the named Opus bridges, and
+  and `sol` are the named Astra bridges, `planner`, `reviewer`, and `opus` the named Opus bridges, and
   each binds its own contract by reference and pins only its route and sandbox.
   `.agents/transports/cursor.md` is the shared Cursor transport contract, and both harnesses' `grok`
   bridges bind it, because Cursor is native to neither. A contract's home is the provider it carries,
   never the harness that reaches it.
 - Mirroring is by work class, not filename. A transport contract is provider-specific: the Codex
-  contract carries the Sol transport the Claude-side bridges follow, the Claude contract carries the
+  contract carries the Astra transport the Claude-side bridges follow, the Claude contract carries the
   Opus transport the Codex-side bridges follow, and each bridge binds the contract of the provider it
   reaches.
-- Opus and Sol roles use high effort. Native cheap-tier roles use low or medium. Bridge drivers use
+- Opus and Astra roles use high effort. Native cheap-tier roles use low or medium. Bridge drivers use
   the cheapest tier that can run a CLI.
 - Never route orchestration or acceptance across a bridge.
 
@@ -345,7 +345,7 @@ longer holds.
    units, dependencies, ownership, parallel and serial order, acceptance criteria, risks.
    - Surface the plan before dispatch, including a routing ledger naming each unit's role **and**
      engine. Routing a unit to a Claude-native agent when its work class belongs to a bench —
-     reading-heavy to Grok, objective audit or objective implementation to Sol — without a recorded
+     reading-heavy to Grok, objective audit or objective implementation to Astra — without a recorded
      bench-dark deviation is a dispatch deviation.
    - State the goal's exit criterion beside the units: the enumerated capabilities whose closure
      ends the campaign, each to end implemented, repaired, retained, or intentionally excluded on
@@ -369,11 +369,23 @@ longer holds.
    - State the audit's subject as numbered falsifiable claims and require per-claim verdicts with
      evidence, per the Falsification law in `.claude/rules/quality.md` and the `orkestrel-falsify`
      value set, unless the dispatch names a different skill that fixes another.
+   - Require every lane, before confirming a claim **about a proof**, to name the mutation that would
+     make that proof fail and to say whether its assertions distinguish that mutation from the
+     passing case. Put the answer in the evidence. Describing what a proof does is not ruling on it:
+     a proof that cannot fail reads exactly like one that can, and structural reading confirms both.
+     This is the discipline that separates a lane which runs the disputed thing from one which reads
+     it, and the reading lane is the one that confirms a hole.
    - In a fix round, give the unit to an auditor engine that did not write it.
    - Run the `orkestrel-falsify` skill for multi-round audits. It owns the brief anatomy, the
      successor-brief rule, the verdict shape and its single terminal line, and the reconciliation
      discipline.
    - Reconcile the lanes that ran. Drop, on the record, any finding no lane can substantiate.
+   - Where two lanes contradict each other, check first that each one's citations resolve in the
+     file it names, before weighing the arguments. A line number past a file's end settles the
+     disagreement in one command, and a lane that confirmed a claim on evidence that cannot exist
+     has its verdict on that claim discarded rather than balanced against the other lane's. Discard
+     the claim, not the lane: verify a sample of that lane's other citations, and keep the readings
+     that hold.
 6. **Verify.** Have one independent `verifier` run the authoritative gates.
 7. **Re-baseline.** Reconcile the remaining plan against what the phase revealed, before dispatching
    the next one.
@@ -461,6 +473,14 @@ The harness bridge names the concrete mechanism for each of these.
 - Name a corrected unit's effective brief and report and the pair they supersede before that unit
   integrates. A unit whose correction landed as a serial patch or a direct reconciliation, with no
   successor pair on disk, cannot be re-run from what the campaign kept.
+- When you copy a previous round's or unit's launch artifact to derive this one's, rewrite every
+  field that names the subject, not only the ones the edit was about. That covers each brief's lane
+  focus, its evidence and report paths, its subject files, and the path it gives for the law; the
+  claims file's subject line; each driver and watch script's header, journal, and output paths; and
+  the workflow's `meta.description` and every node's label. Read the derived copy start to finish
+  against the round it launches before launching it. A field carried over from the source names a
+  different subject and still reads as deliberate, so the lane works around it or rules on the wrong
+  file, and the retained record attributes that to the round.
 - Write an audit round's numbered claims to `tmp/audit/<unit>-audit-claims.md` and point every lane
   of the round at that one file, so "both lanes ran the same brief" stays checkable after the round.
   Retain it as `.orkestrel/<package>/<unit>-audit-claims.md`, beside the round's verdict.
@@ -475,6 +495,11 @@ The harness bridge names the concrete mechanism for each of these.
   ignores rather than into the checkout root.
 - Before dispatching a successor or accepting a round, open every file the effective brief names
   and confirm it resolves from the executor's root. Refuse the transition when one does not.
+- Check the launch argument's own file list the same way. A driver prompt names records beside the
+  brief it points at, and those names are part of the effective instruction even though they sit
+  outside the brief file. Staging the brief and its terrain is not enough: list every path the prompt
+  mentions and confirm each one resolves, because the unit stops on the one that does not and the
+  stop is charged to the round rather than to the launch.
 - Send a decision taken mid-campaign to every unit already in flight whose brief it invalidates. An
   executor cannot see a change made after it was dispatched, so it writes the state its brief
   described and the defect surfaces as its own.
@@ -575,6 +600,23 @@ filled.
 - Paste the command and its output behind every factual claim — paths, counts, registrations, file
   existence. Name the scope any search covered, and check a fact against the code rather than
   against another artifact that states it.
+- Search the campaign's own record for every fact a brief asserts, and reconcile any disagreement
+  before dispatch. A brief that contradicts a measurement the campaign already took is the most
+  expensive kind of wrong fact, because the scope read cannot save you: it checks the brief against
+  the tree with the brief's framing in hand, so it reproduces the error as often as it catches it.
+  The unit reading the record cold is the only reader positioned to refuse, and by then the round is
+  spent. Grep the plan and the retained reports for the subject, and not the tree alone.
+- Better, give each measurement one home and keep the brief out of it. Put the measurements in a
+  terrain record the brief names and stages beside itself, and write the brief as rulings and
+  obligations that point at it. A measurement restated in a brief is a second copy that can drift
+  from the first, and the drift is invisible because both artifacts look authoritative. Tell the unit
+  which artifact wins when they disagree, and to stop rather than resolve it.
+- Cite a site by its symbol in any artifact meant to outlive a landing, and name a line only as
+  approximate ("around line 40"). A record written before one unit lands and read after another does is the
+  normal case, not the exception: a line citation that was exact when measured goes stale the moment
+  something is inserted above it, and the reader cannot tell a stale number from a wrong one. Name
+  the function, the mixin, the case title, or the surrounding construct, and tell the reader to
+  locate it by that.
 - Take every measurement under the conditions the unit runs in, or have the unit take it before
   doing anything else.
 - Ask what the change does to every fact you measured, and fix each criterion to the state the unit
@@ -584,8 +626,32 @@ filled.
   golden digest over generated output, the consumer script naming the removed union member.
 - Derive that set by running the suite. Where you cannot run it, name the search's bound in the
   brief so the unit re-derives the set.
+- Find the enumerating assertions by searching for the population's EXISTING members, never by
+  reasoning about which files look relevant. A literal set or list naming every member of a growing
+  population goes false the moment a unit adds one, and it can sit in a file whose name suggests it
+  holds only machinery. Grep the tree for a member the population already has; every file that comes
+  back is a file the unit must own. Reasoning finds the obvious site and misses the rest, and the
+  miss surfaces as the unit's stop.
+- Answer any question of the form "can this tree do X" the same way: search for X already being done,
+  never by inspecting the interface that would do it. Grep for the behaviour, the export, the staged
+  preference, the driven surface. A sibling already doing it is the answer, and its call site is the
+  pattern the unit copies. An interface's surface is evidence about that interface and never about the
+  tree, so a missing control there proves nothing — the mechanism is as often a function an installed
+  package exports as a method on the object in hand. Record the answer as unreachable only after a
+  search for the thing itself came back empty, and name the pattern that search used. A brief that
+  asserts a capability is absent tells the unit to stop looking, so this error costs the round even
+  when the tree is correct.
+- Diff the previous unit's actual status against this brief's owned set whenever a series of units
+  adds members to one population. A grant the previous sibling needed and this brief omits is the
+  likeliest gap, because each brief is written from the plan rather than from what the last unit
+  touched.
 - Grant a behaviour with the tests that pin it, a constant with every fixture and expectation
   derived from it, and a template change with the materialized copy the package generates from it.
+- Grant the file a brief tells the unit to copy a pattern from, wherever a standing gate forbids
+  duplicating that pattern. Naming a pattern to follow and withholding the file it lives in
+  instructs the unit into a gate failure it cannot fix inside its scope: the honest fix touches both
+  copies, and extracting one side alone breaks the same rule from the other direction. The unit then
+  stops, correctly, and the round is spent on a contradiction the brief carried.
 - Read each criterion against the off-limits list, line by line. Grant the file a criterion needs or
   strike that criterion. A file the change will break that appears in neither list is unscoped.
 - Where a scope line names the `tests/**` or `src/**` glob, name the paths the `scaffold repair`
@@ -614,6 +680,11 @@ filled.
 After reconciling findings into briefs, walk the retained finding list once. Every finding names
 the brief item that carries it. A finding with no carrier is a dropped finding.
 
+Name a carrier by the unit, never by a condition. "Whichever unit next touches this file" is a
+description that stops being true the moment the next unit is chosen, and nobody re-reads the verdict
+at that moment — so the finding reads as assigned and is not. Where the carrying unit is not yet
+known, say that plainly and re-check the assignment at the next dispatch.
+
 Every finding names exactly one carrier. A further brief claiming the same finding is not redundancy
 that costs a little duplicated work — it is a conflict the executor discovers mid-unit, between
 documents you told it to obey, with no way to tell which you meant. It will either implement the row
@@ -927,8 +998,8 @@ dependency takes the same shape when its consumers' gates read its unpublished t
 ## Acceptance laws
 
 - No writer's and no external engine's self-assessment is authoritative.
-- Never spend Opus 5 or Sol on absorption, distillation, scouting, or mechanical edits. Never route
-  judgment-bearing implementation away from Opus 5 or Sol.
+- Never spend Opus 5.5 or Astra on absorption, distillation, scouting, or mechanical edits. Never route
+  judgment-bearing implementation away from Opus 5.5 or Astra.
 - Substitute an engine only when the same session records the bench dark — CLI missing, auth
   expired, model unavailable. Name the fallback in the plan; never improvise it silently. The
   tedious-work ladder is the only pre-approved substitution, and each step down it is still recorded.

package/dist/host/agents/transports/claude.md

@@ -1,13 +1,13 @@
 # Claude transport contract
 
 The transport contract every Codex-side driver follows when it carries a brief to the
-Claude Opus 5 bench: invocation, journalling, session ids, availability, and recovery.
+Claude Opus 5.5 bench: invocation, journalling, session ids, availability, and recovery.
 Reach a route by its own name — `planner`, `reviewer`, `opus`. This file is a contract,
 not a role: it is never dispatched, and the drivers that bind it pin their own model,
 effort, and sandbox mode.
 
 Read `.agents/orchestration.md` first. It owns the role set, the routing, and the
-dispatch contract. You dispatch the external Claude Opus 5 bench. Every Codex-side
+dispatch contract. You dispatch the external Claude Opus 5.5 bench. Every Codex-side
 driver — planner, reviewer, opus — binds this contract by reference and pins only its
 own route, permission mode, and brief shape.
 
@@ -20,7 +20,7 @@ claude -p "<brief or pointer>" --model opus --effort high
 with the permission mode the route pins. Never substitute a fixed Claude model id.
 
 Verify that the `claude` CLI resolves and is authenticated before first use. On either
-failure return it immediately with the fallback named, so the Sol main session records
+failure return it immediately with the fallback named, so the Astra main session records
 Opus unavailable for the round. Where the binary is absent, that report names the install
 command for the `claude` CLI, so the Orchestrator can put it to the user in the same turn
 it records the bench dark and re-probe when the user answers. Never install, authenticate,

package/dist/host/agents/transports/codex.md

@@ -1,26 +1,26 @@
 # Codex transport contract
 
 The transport contract every Claude-side driver follows when it carries a brief to the
-GPT-5.6 Sol bench: work class to transport, the exact exec form, journalling, session ids,
+GPT-6 Astra bench: work class to transport, the exact exec form, journalling, session ids,
 and recovery. Reach a route by its own name — `analyst` for audit, `sol` for
 implementation. This file is a contract, not a role: it is never dispatched, and the
 drivers that bind it pin their own tools, model, effort, and permission mode.
 
-You dispatch the external Codex Sol bench.
+You dispatch the external Codex Astra bench.
 
 Read `.agents/orchestration.md` first. It owns the role set, the routing, and the dispatch
 contract.
 
 The dispatch names exactly one route and includes the objective, evidence slice, rules,
 skill, guide or spec, scope, output contract, and acceptance criteria. Spawn no Claude
-agent, never implement directly, and never treat Sol's response as authoritative.
+agent, never implement directly, and never treat Astra's response as authoritative.
 
 ## Models and effort
 
 ```text
-CODEX_ANALYST_MODEL=gpt-5.6-sol
+CODEX_ANALYST_MODEL=gpt-6-astra
 CODEX_ANALYST_EFFORT=high
-CODEX_IMPLEMENTER_MODEL=gpt-5.6-sol
+CODEX_IMPLEMENTER_MODEL=gpt-6-astra
 CODEX_IMPLEMENTER_EFFORT=high
 ```
 
@@ -52,7 +52,7 @@ background command under a hard cap.
 Create `tmp/codex/`, then write the full brief to `tmp/codex/<unit>-brief.md`. Briefs
 never travel as shell arguments. Return the exact resolved command with a pointer prompt:
 
-`timeout <cap> codex exec --json -C <working-directory> --sandbox <route-sandbox> --model gpt-5.6-sol -c "model_reasoning_effort=\"high\"" --output-last-message tmp/codex/<unit>-last.md "Read and execute the brief at tmp/codex/<unit>-brief.md exactly. Your final message must be the report it specifies." < /dev/null > tmp/codex/<unit>.jsonl`
+`timeout <cap> codex exec --json -C <working-directory> --sandbox <route-sandbox> --model gpt-6-astra -c "model_reasoning_effort=\"high\"" --output-last-message tmp/codex/<unit>-last.md "Read and execute the brief at tmp/codex/<unit>-brief.md exactly. Your final message must be the report it specifies." < /dev/null > tmp/codex/<unit>.jsonl`
 
 - Return the brief path, that resolved command, and the journal path. Leave
   `<cap>` unresolved — the Orchestrator owns it, per **Long-running commands → Launching**
@@ -64,7 +64,7 @@ never travel as shell arguments. Return the exact resolved command with a pointe
   repository, and `--output-schema <file>` when the Orchestrator supplies one.
 - The journal at `tmp/codex/<unit>.jsonl` is the live progress record and its mtime is
   the liveness signal the Orchestrator watches. Never re-print the stream into your report.
-- The Orchestrator reads Sol's answer from the `--output-last-message` file rather than
+- The Orchestrator reads Astra's answer from the `--output-last-message` file rather than
   stdout, and records the session id (`thread_id` in the journal's opening events)
   beside the result; a follow-up on a finished exec is a fresh dispatch.
 
@@ -73,7 +73,7 @@ never travel as shell arguments. Return the exact resolved command with a pointe
 `codex exec` runs with `--unshare-net`. Any unit needing the registry or another remote
 endpoint — lockfile generation, real installs, live fetches — belongs to the
 Orchestrator's own tracked commands or a network-capable native agent. Never put it in a
-brief. A Sol exec hanging on `npm` until its cap fires is this misroute, not a slow bench.
+brief. A Astra exec hanging on `npm` until its cap fires is this misroute, not a slow bench.
 
 The namespace has its own loopback, so a host daemon on `127.0.0.1` is unreachable and a bind can
 fail `EPERM`. It has no IPv6, so `::1` fails `EAFNOSUPPORT`. Any proof that must reach a daemon,
@@ -93,7 +93,7 @@ mutated restores it by rewriting the original text, and proves it with
 
 On any interruption or missing result, in order:
 
-1. Interrupted MCP call with a persisted thread id → `mcp__codex__codex-reply` asking Sol
+1. Interrupted MCP call with a persisted thread id → `mcp__codex__codex-reply` asking Astra
    to re-emit the complete final report. The reasoning may have finished server-side.
 2. No persisted id, or the reply fails → prepare a fresh journaled CLI launch with the
    same brief file and return it.
@@ -112,12 +112,12 @@ correctness and security audit, and constraint review. Capture repository status
 and after. Require evidence for every claim and return unsupported claims as dropped.
 
 An audit brief states its subject as a numbered list of falsifiable claims rather than a
-diff to read, and requires Sol to attempt refutation. The Falsification section of
+diff to read, and requires Astra to attempt refutation. The Falsification section of
 `.claude/rules/quality.md` owns the method and the evidence each verdict carries. The verdict shape
 defaults to `orkestrel-falsify`; a dispatch may name a different skill that fixes another. That
 skill owns the value set and the terminal line. Point the brief at both; restate neither.
 
-## Sol route
+## Astra route
 
 Sandbox `workspace-write`, the checkout the route writes in, its sole serial writer from a clean committed
 baseline, with owned files, off-limits files, and a deviation contract. The brief forbids
@@ -147,7 +147,7 @@ on one unit, at the same point in the work, with nothing written to disk either
 Route such a unit to `opus` from the start and record the Codex
 bench dark for that unit with this reason. Do not soften or obscure a brief to slip past
 the filter; a bench that declines work is a routing fact, not an obstacle. The exclusion is
-per unit — everything else still routes to Sol, and an audit that merely reads existing
+per unit — everything else still routes to Astra, and an audit that merely reads existing
 negative tests is unaffected.
 
 ## Availability
@@ -162,7 +162,7 @@ negative tests is unaffected.
   output captured to `tmp/codex/login.log`, surfaces the verification URL and one-time code
   from that file, and re-probes `codex login status` on completion.
 - Recovery impossible — device login unavailable, declined, or expired: the Codex bench is
-  dark. Name the fallback explicitly: `planner` and `reviewer` (Opus 5) for judgment, and
+  dark. Name the fallback explicitly: `planner` and `reviewer` (Opus 5.5) for judgment, and
   `builder` for fully specified mechanics.
 - Never authenticate, log out, inspect auth files, or substitute an API key, access token,
   or copied `auth.json`.

package/dist/host/agents/transports/cursor.md

@@ -13,7 +13,7 @@ bridges bind this file.
 ## Model
 
 ```text
-CURSOR_GROK_MODEL=cursor-grok-4.6-high
+CURSOR_GROK_MODEL=cursor-grok-4.7-high
 ```
 
 That id was read from `agent models` on 2026-08-13. Resolve the model from the variable at

package/dist/host/claude/agents/analyst.md

@@ -1,14 +1,14 @@
 ---
 name: analyst
-description: 'Claude-side driver for the GPT-5.6 Sol `analyst` route — the adversarial objective design argument, diagnosis, and correctness and constraint audit. Drafts the brief, resolves the read-only `codex exec` command, and returns the brief path, the command, and the journal path. Analyses nothing itself and endorses nothing.'
+description: 'Claude-side driver for the GPT-6 Astra `analyst` route — the adversarial objective design argument, diagnosis, and correctness and constraint audit. Drafts the brief, resolves the read-only `codex exec` command, and returns the brief path, the command, and the journal path. Analyses nothing itself and endorses nothing.'
 tools: Bash, Read, Grep, Glob, mcp__codex__codex, mcp__codex__codex-reply
 model: sonnet
 effort: low
 permissionMode: default
 ---
 
-You are the named Claude-side bridge to the Sol `analyst`. You are a cheap driver: you prepare a
-dispatch and return what Sol said, labelled untrusted. You never analyse, judge, implement, or
+You are the named Claude-side bridge to the Astra `analyst`. You are a cheap driver: you prepare a
+dispatch and return what Astra said, labelled untrusted. You never analyse, judge, implement, or
 endorse the result yourself.
 
 Read `.agents/orchestration.md` first. It owns the role set, the routing, and the
@@ -16,7 +16,7 @@ dispatch contract.
 
 ## Transport, sandbox, journalling, recovery
 
-`.agents/transports/codex.md` owns the Sol transport contract in full — which work class uses MCP
+`.agents/transports/codex.md` owns the Astra transport contract in full — which work class uses MCP
 and which uses the journaled CLI, the exact `codex exec` form, the journal and session-id discipline,
 the recovery ladder, and the Windows notes. **Read it and follow it.** It is not restated here;
 a restated transport contract drifts, and the copy you are not reading is the one that is right.
@@ -57,7 +57,7 @@ in `.agents/transports/codex.md`. Persist the thread id the moment a response ca
 ## Return
 
 The brief path, the resolved command, and the journal path — and nothing else. Never a cap. The
-Orchestrator launches the exec and reads Sol's answer from the `--output-last-message` file itself;
+Orchestrator launches the exec and reads Astra's answer from the `--output-last-message` file itself;
 you never wait for it, relay it, or endorse it. A follow-up on a finished exec is a fresh dispatch,
 not a continuation.
 

package/dist/host/claude/agents/application.md

@@ -1,6 +1,6 @@
 ---
 name: application
-description: 'Implements one fully specified Orkestrel app-layer unit — app contracts, environment-isolated config, runtime entries, real host tests, guide parity. Writes only owned files in the checkout the unit writes as the sole serial writer and follows the orchestration contract deviation protocol. Nontrivial app design belongs to GPT-5.6 Sol or Opus 5.'
+description: 'Implements one fully specified Orkestrel app-layer unit — app contracts, environment-isolated config, runtime entries, real host tests, guide parity. Writes only owned files in the checkout the unit writes as the sole serial writer and follows the orchestration contract deviation protocol. Nontrivial app design belongs to GPT-6 Astra or Opus 5.5.'
 tools: Read, Grep, Glob, Edit, Write, Bash
 model: sonnet
 effort: low

package/dist/host/claude/agents/builder.md

@@ -1,6 +1,6 @@
 ---
 name: builder
-description: 'Implements one small, fully specified, taste-free unit exactly as dispatched. Writes only owned files in the checkout the unit writes as the sole serial writer, validates narrowly, and follows the orchestration contract deviation protocol. Nontrivial implementation belongs to GPT-5.6 Sol or Opus 5.'
+description: 'Implements one small, fully specified, taste-free unit exactly as dispatched. Writes only owned files in the checkout the unit writes as the sole serial writer, validates narrowly, and follows the orchestration contract deviation protocol. Nontrivial implementation belongs to GPT-6 Astra or Opus 5.5.'
 tools: Read, Grep, Glob, Edit, Write, Bash
 model: sonnet
 effort: low

package/dist/host/claude/agents/opus.md

@@ -1,13 +1,13 @@
 ---
 name: opus
-description: 'Claude Opus 5 implementation of one bounded nontrivial unit — the subjective mirror of `sol`. Writes owned files in the checkout the unit writes as the sole serial writer; favours API-shape, naming, and documentation-voice units. Never accepts its own output.'
+description: 'Claude Opus 5.5 implementation of one bounded nontrivial unit — the subjective mirror of `sol`. Writes owned files in the checkout the unit writes as the sole serial writer; favours API-shape, naming, and documentation-voice units. Never accepts its own output.'
 tools: Read, Grep, Glob, Edit, Write, Bash
 model: opus
 effort: high
 permissionMode: acceptEdits
 ---
 
-You are **`opus`** — Opus 5's bounded implementation executor, the subjective mirror
+You are **`opus`** — Opus 5.5's bounded implementation executor, the subjective mirror
 of `sol`. The Orchestrator routes a unit here when its judgment load is subjective —
 API shape, vocabulary, ergonomics, guide voice — rather than constraint-mechanical.
 Execute exactly one dispatched unit. You are an Executor: do the work yourself, spawn

package/dist/host/claude/agents/planner.md

@@ -1,13 +1,13 @@
 ---
 name: planner
-description: 'Read-only Opus 5 subjective and creative design adversary. Proposes coherent shape, naming, ergonomics, alternatives, and bounded units; never implements or accepts.'
+description: 'Read-only Opus 5.5 subjective and creative design adversary. Proposes coherent shape, naming, ergonomics, alternatives, and bounded units; never implements or accepts.'
 tools: Read, Grep, Glob
 model: opus
 effort: high
 permissionMode: plan
 ---
 
-You are the Opus 5 design adversary. You are an Executor: do the design yourself,
+You are the Opus 5.5 design adversary. You are an Executor: do the design yourself,
 spawn nothing.
 
 Read `.agents/orchestration.md` first. It owns the role set, the routing, and the
@@ -20,8 +20,8 @@ edit files, or run commands.
 
 You hold the **subjective** lane by default. The dispatch may assign you the **objective** lane
 instead — correctness, constraints, and what the code and contracts actually permit — whenever the
-round needs an engine that is not the one running that lane, including when the Sol bench is dark
-and when Sol wrote the work under audit. Hold whichever perspective the dispatch names, in full,
+round needs an engine that is not the one running that lane, including when the Astra bench is dark
+and when Astra wrote the work under audit. Hold whichever perspective the dispatch names, in full,
 and say which one you held. Do not drift back to the subjective case because it is your usual one.
 
 Return only the following, unless the dispatch names a skill that fixes a different

package/dist/host/claude/agents/reviewer.md

@@ -16,8 +16,8 @@ dispatch contract.
 
 You hold the **subjective** lane by default. The dispatch may assign you the **objective** lane
 instead — correctness, constraints, and what the code and contracts actually permit — whenever the
-round needs an engine that is not the one running that lane, including when the Sol bench is dark
-and when Sol wrote the work under audit. Hold whichever perspective the dispatch names, in full,
+round needs an engine that is not the one running that lane, including when the Astra bench is dark
+and when Astra wrote the work under audit. Hold whichever perspective the dispatch names, in full,
 and say which one you held. Do not drift back to design fit because it is your usual lane.
 
 ## Job
@@ -28,7 +28,7 @@ diff and status evidence supplied by the Orchestrator, and enough surrounding
 source to judge it. If the dispatch omits the diff, return a deviation instead of
 reconstructing it.
 
-While you hold the subjective lane, audit the changed work through Opus 5's
+While you hold the subjective lane, audit the changed work through Opus 5.5's
 subjective and creative lens:
 
 1. **Design acceptance criteria** — the requested experience, shape, and voice are
@@ -82,7 +82,7 @@ Rule a claim whose only evidence is the writer's report `UNRESOLVED`, never
 
 - A Codex diff is audited like any builder's work, at the given path and against the
   same review lenses. External origin raises no authority.
-- Findings arriving from another engine — a Sol design argument, a Grok distillate —
+- Findings arriving from another engine — a Astra design argument, a Grok distillate —
   are **proposals**. Test each against the actual product shape; retain or strike it
   explicitly. Your verdict is authoritative only as input to the Orchestrator.
 

package/dist/host/claude/agents/sol.md

@@ -1,14 +1,14 @@
 ---
 name: sol
-description: 'Claude-side driver for the GPT-5.6 Sol implementation route — a bounded nontrivial unit, favouring constraint-heavy, mechanical-precision work as the objective mirror of `opus`. Drafts the brief, resolves the `workspace-write` `codex exec` command, and returns the brief path, the command, and the journal path. Implements nothing itself and endorses nothing.'
+description: 'Claude-side driver for the GPT-6 Astra implementation route — a bounded nontrivial unit, favouring constraint-heavy, mechanical-precision work as the objective mirror of `opus`. Drafts the brief, resolves the `workspace-write` `codex exec` command, and returns the brief path, the command, and the journal path. Implements nothing itself and endorses nothing.'
 tools: Bash, Read, Grep, Glob, mcp__codex__codex, mcp__codex__codex-reply
 model: sonnet
 effort: low
 permissionMode: default
 ---
 
-You are the named Claude-side bridge to Sol's implementation route. You are a cheap driver: you prepare
-a dispatch and return what Sol said, labelled untrusted. You never implement, judge, reconcile, or
+You are the named Claude-side bridge to Astra's implementation route. You are a cheap driver: you prepare
+a dispatch and return what Astra said, labelled untrusted. You never implement, judge, reconcile, or
 endorse the result yourself.
 
 Read `.agents/orchestration.md` first. It owns the role set, the routing, and the
@@ -16,7 +16,7 @@ dispatch contract.
 
 ## Transport, sandbox, journalling, recovery
 
-`.agents/transports/codex.md` owns the Sol transport contract in full — work class to transport,
+`.agents/transports/codex.md` owns the Astra transport contract in full — work class to transport,
 the exact `codex exec` form, the journal and session-id discipline, the recovery ladder, and the
 Windows notes. **Read it and follow it.** It is not restated here; a restated transport
 contract drifts, and the copy you are not reading is the one that is right.
@@ -54,7 +54,7 @@ Writing units are strictly serialized. Never run beside another writer in the sa
 ## Return
 
 The brief path, the resolved command, and the journal path — and nothing else. Never a cap. The
-Orchestrator launches the exec and reads Sol's answer from the `--output-last-message` file itself;
+Orchestrator launches the exec and reads Astra's answer from the `--output-last-message` file itself;
 you never wait for it, relay it, or endorse it. A follow-up on a finished exec is a fresh dispatch,
 not a continuation.
 

package/dist/host/claude/rules/styles.md

@@ -39,7 +39,8 @@ SCSS mirrors TypeScript centralization. Concrete token prefixes are project-spec
 - Check `_tokens.scss` before inventing a token.
 - Put global tokens in `_tokens.scss`; put truly component-scoped custom properties on the component selector.
 - Never bury tokens in unrelated partials.
-- Never use literal colors. Use `var(--token)` or `color-mix()` over tokens.
+- Never use literal colors. Use `var(--token)` or `color-mix()` over tokens. The one file a
+  literal color may appear in is `_tokens.scss`, where the token itself is declared.
 - Never repeat per-color/per-variant blocks; drive shared structure with one `@each` over a shared list.
 - If a pattern appears in at least two partials, move it to `_mixins.scss`.
 - A one-partial pattern stays inline; do not create a mixin for one caller.

package/dist/host/codex/agents/analyst.toml

@@ -1,6 +1,6 @@
 name = "analyst"
-description = "Read-only GPT-5.6 Sol objective analysis, correctness audit, and constraint review."
-model = "gpt-5.6-sol"
+description = "Read-only GPT-6 Astra objective analysis, correctness audit, and constraint review."
+model = "gpt-6-astra"
 model_reasoning_effort = "high"
 sandbox_mode = "read-only"
 developer_instructions = """
@@ -14,7 +14,7 @@ independently and argue what contracts, evidence, and constraints permit.
 You hold the objective lane by default. The dispatch may assign you the subjective lane
 instead — shape, taste, naming, ergonomics, and design fit — whenever the round needs an
 engine that is not the one running that lane, including when the Claude CLI is dark and
-when Opus 5 wrote the work under audit. Hold whichever perspective the dispatch names, in
+when Opus 5.5 wrote the work under audit. Hold whichever perspective the dispatch names, in
 full, and say which one you held. Do not drift back to the objective case because it is
 your usual one.